input {
    file {
        type => "ycc_access_log"
        path => ["/usr/local/tomcat/logs/*_access.*.log"]
        start_position => "beginning"
        exclude => "*.gz"
    }

    file {
        type => "ycc_core_log"
        path => ["/usr/local/tomcat/logs/catalina-daemon.out"]
        start_position => "beginning"
        codec=> multiline {
            pattern => "(^.+Exception:.+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)"
            what=> "previous"
            negate => false
        }
    }
}


filter {
    if [type] == "ycc_core_log" {
        grok {
            patterns_dir => "/etc/logstash/patterns.d"
            match => {
                "message" => "%{TOMCATLOG}"
            }
        }
    }

    if [type] == "ycc_access_log" {
        grok {
            patterns_dir => "/etc/logstash/patterns.d"
            match => {
                "message" => "%{ACCESS_LOG}"
            }
        }
    }

    mutate {
        remove_field =>["message"]
        remove_field =>["path"]
    }
}

output {
    if [type] == "ycc_access_log" {
        elasticsearch {
            hosts => ["{{ monitor_ip }}:9200"]
            index => "ycc-access"
        }
    }

    if [type] == "ycc_core_log" {
        elasticsearch {
            hosts => ["{{ monitor_ip }}:9200"]
            index => "ycc-core"
        }
    }
}
